From 2deca0ec19a1d36afc12190436d718b4d3a2a596 Mon Sep 17 00:00:00 2001
From: Niklas Haas <git@haasn.dev>
Date: Wed, 25 Mar 2026 11:14:06 +0100
Subject: [PATCH] swscale: clean up allocated frames on error

Matches the semantics of sws_frame_begin(), which also cleans up any
allocated buffers on error.

This is an issue introduced by the commit that allowed ff_sws_graph_run()
to fail in the first place.

Fixes: 563cc8216bd9253d2563641341f4af611aaf9554
---
 libswscale/swscale.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/libswscale/swscale.c b/libswscale/swscale.c
index 481cab091c..d5c91e541c 100644
--- a/libswscale/swscale.c
+++ b/libswscale/swscale.c
@@ -1366,7 +1366,7 @@ static int frame_ref(AVFrame *dst, const AVFrame *src)
 
 int sws_scale_frame(SwsContext *sws, AVFrame *dst, const AVFrame *src)
 {
-    int ret;
+    int ret, allocated = 0;
     SwsInternal *c = sws_internal(sws);
     if (!src || !dst)
         return AVERROR(EINVAL);
@@ -1411,12 +1411,16 @@ int sws_scale_frame(SwsContext *sws, AVFrame *dst, const AVFrame *src)
     ret = frame_alloc_buffers(sws, dst);
     if (ret < 0)
         return ret;
+    allocated = 1;
 
 process_frame:
     for (int field = 0; field < (bot ? 2 : 1); field++) {
         ret = ff_sws_graph_run(c->graph[field], dst, src);
-        if (ret < 0)
+        if (ret < 0) {
+            if (allocated)
+                av_frame_unref(dst);
             return ret;
+        }
     }
 
     return 0;